thelightfinder

  Lab 2: Basic SSRF against another back-end system Task :  This lab has a stock check feature that fetches data from an internal system. To solve the lab, use the stock check functionality to scan the internal 192.168.0.X range for an admin interface on port 8080, then use it to delete the user Carlos. This Lab is just slightly different from the previous lab , we need to use the SSRF vulnerability to scan the internal server and find the right host serving a web app on port 8080 and then delete the user Carlos. The stock check functionality remains the same as in the previous lab: The stock check URL is now different, pointing to an internal non-routable IP address. Using Burp Intruder we brute force and found the host at 192.168.0.170 . We then send a request to delete the user Carlos. And that's it we solved the lab. All of these labs feel too easy so am gonna skip the write-up on the easy ones from this point forward, otherwise, I feel I won't make significant progre...

This will InshaAllah be the beginning of a series of posts on my Server Side Request Forgery SSRF research journey. Why SSRF? Well, I recently came across the 3-Months Microsoft Azure SSRF research challenge and because I strongly believe there are a lot of uncharted areas in SSRF research, I decided to partake and who knows maybe I might earn myself a little bounty along the way :). Game Plan Currently, the plan is simple, get myself up to speed with the current state of the art in SSRF research by solving CTFs and freely available Lab challenges to gather some intuition and then move on to asking questions with regards to the current limitations of known exploit techniques, hopefully, I will stumble on something new. I will start with Solving Portswigger Web Security Academy Labs in this post and then other CTF challenges in the subsequent posts. PS: most of the posts on SSRF will be fast-paced it's just meant to serve as self notes for reference and to organize my thoughts L...

Introduction I was recently going through the cryptohack  challenges when I came across the Greatest Common Divisor (GCD) challenge, this challenge is a novice level challenge where you are expected to code up a function to compute the GCD of two numbers, a link to Euclid's Algorithm was provided as a hint to solve the problem. Normally, as expected I followed the link just to brush up on my understanding, considering that it's something I already knew. Soon after I proceeded to code up the function and then realized I was missing a great deal of what was supposed to be intuitive, that is, I did not properly understand the algorithm as I thought, hence this post. So what is Euclid's Algorithm? It's an algorithm attributed to 300 B.C. Greek mathematician Euclid , for efficiently computing the greatest common divisor of two numbers, this algorithm has a wide array of uses especially in the field of cryptography. The GCD of any two numbers, for example, 5 and 12, is the l...

Link to Lab 6 To solve this lab, we need to bypass the application's check for file type extension and exploit the directory traversal vulnerability in the image display endpoint. Check whether the application filters our input: Response from Server: The server doesn't recognize the file, let's try bypassing with null byte: Response from Server: Lab Solved!

Lab 6 Link To solve this lab we need to exploit path traversal vulnerability in the image display endpoint, the application validates the supplied path starts with the expected folder. Let's test the application behavior: Server Response: Nothing is blocked so we exploit the application using this request: Response from Server: Lab Solved!

Link to Lab 4 This Lab has a path traversal vulnerability in the image display endpoint, it attempts to defeat exploitation by stripping the path traversal sequence from the user input before decoding and using the input. The task is to read /etc/passwd  file. As usual, test with normal exploit: Response from Server: The server responded with the image, we can confirm that the input is being stripped. Let's try encoding our input be before sending to the server and hopefully the server will decode it for us: Server Response: The server disagrees, let try doubly encoding the input: Server Response: Lab Solved!

Link to Lab 3   In this Lab, the Task is to retrieve the content of the /etc/passwd  by exploiting path traversal vulnerability in the product display image endpoint. The application attempts to block exploitation by stripping path traversal sequences from the input before usage. Attempting to exploit the vulnerability with normal path traversal sequences: The server responded with: We can inference that our path traversal sequences have been stripped, let's test a bypass by doubling the sequences: Server Response: Lab Solved!